PATENT 

AMENDMENT-AFTER-FINAL 



REMARKS 



I. Rejections under Section 101 

The Examiner rejected claims 12-16 under 35 USC 101 because the server and client 
components have not been limited to hardware in the Specification. Applicant acknowledges 
that the inventions in claims 12-16 can be implemented in hardware, software, or a combination 
thereof. However, Applicant respectfully asserts that the claims, as amended, meet the machine 
prong articulated in the recent Federal Circuit Bilski decision. Claim 12 is now directed to a 
specific machine, namely an application server in a distributed application environment, 
comprising: 

a transfer server component which, in a first computer process, supports non- 
continuous and secure client-server connection for receiving certificate information from 
a client of a third tier server certificates being accepted as trustworthy for determining to 
accept or to decline a connection to said third tier server system, 

a connection negotiator component which, in a second computer process receives 
incoming third tier server certificates via a secure connection between said application 
server systems and said third tier server, and 

a certificate verifier component which, in a third computer process, compares said 
third tier server certificate received from said third tier server with said certificate 
information received from said client. 

Claim 16 is similarly directed to a specific machine, namely a client system for authenticating 
third tier server in a distributed application environment comprising: 

a connection negotiator component which, in a first computer process, receives 
incoming third tier server certificate via a secure connection from said third tier server, 

a common data base of the distributed application environment which, in a second 
computer process, stores said third tier server certificates received from said third tier 
server system which have been accepted as trustworthy for the distributed application 
environment, 

a certificate verifier component which, in a third computer process, compares said 
received third tier server certificate with information stored in said common database and 
stores them into said common data base if it matches, and 

a user interface component which, in a fourth computer process, allows for 
accepting or rejecting an unknown third tier server certificate not contained in said 
common data base, 

a certificate transmitter component which, in a fifth computer process, generates 
certificate information of said third tier server certificates being accepted as trustworthy 
for determining to accept or to decline a third tier server from said common database and 
transmits them to said application server systems via a secure connection. 
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The Examiner refused to withdraw the previous Section 101 rejections because "the 
machine test is only available for method claims." Office Action mailed March 11, 2009 at pg. 
14. In response, Applicant notes that, while the exact impact ofBilski is still uncertain, the 
Patent Office appears to be applying the machine-or-transformation test to non-method claims. 
Ex parte Cornea-Hasegan, Appeal 2008-4742 (BPAI 1009)(applying Bilski to a "computer 
readable media" claim); but see Ex parte Bo Li, Appeal 2008- 1213 (BPAI 2008) Regardless how 
this debate turns out, however, Applicant respectfully submits that there is no authority for 
subjecting apparatus claims to a more stringent test than method claims. 

II. Rejections under section 103 

The Examiner rejected claims 1,4-9, and 16-17 under 35 U.S.C. 103(a) as being 
unpatentable over Patent Publication 2002/0152382 ("Xiao") in view of Applicant's Background 
Section. The Examiner also rejected claims 2-3 and 10-15 under Section 103(a) as unpatentable 
over Xiao, Applicant's Background Section, and U.S. Patent No. 6,233,577 ("Ramasubramani"). 
Applicant respectfully traverses. 

A. Claim 1 

The invention in claim 1 is generally directed at a method for authenticating a third tier 
server system in a distributed application environment, said distributed application environment 
comprising client system having parts of the distributed application, server systems having the 
remaining parts of the distributed application. As noted in Applicant's specification at paragraph 
[0025], a "significant difference to the prior art is that no database for the certificates at the 
server side is needed anymore." Applicant's specification goes on to state that a major 
enhancement compared to the prior art is that "[n]o local certificate database exists on the server 
systems. Certificate verification is processed exclusively by means of the certificate information 
sent by the client system. There is no need to administer any third tier certificates locally on the 
server systems. " Id. At ^ [0049] (clement numbers removed) 

Xiao, in contrast, is directed at a delivery scheme that allows clients to verify received 
certificates in a two-tier client-server system. In this system, the server sends its server certificate 
to the client. Xiao at ^f0074J. The client then hashes the server certificate, and then compares 



Docket No. DE920030032US1 
Serial No. 10/562,488 



9 



PATENT 

AMENDMENT-AFTER-FINAL 

the result hash with a list of trusted entity 'thumbprints' stored in a 'trusted information object.' 
Id. at H T| [0074] -[0076]. Xiao also describes updating the trusted information object via HTTP, 
or broadcast. Id. at\] [008 1] -[0090]. Because Xiao is directed at a two-tier system, however, 
Applicant respectfully asserts that Xiao fails to teach or suggest a system where "at said server 
systems side said method comprises receiving from said common database of said client system 
at least all necessary information of a third tier server certificate being accepted as trustworthy 
for determining to accept or to decline a connection to said third tier server" and "comparing said 
received at least all necessary information with a server-copy of the third tier certificate received 
from said third tier server system." 

The Examiner relies on Xiao [0088] and Xiao [0050] as teaching this element, 
analogizing the TIO to the claimed common database and also citing various blocks in Figure 2. 
Office Action moiled March II, 2009 at pg. 3. In response, Applicant respectfully submits that 
this analogy still fails to meet the claims. The TIO in Xiao is not "received]" from the client 
system" "at said server system[]," as claimed in claim 1 . Similarly, the server in Xiao does not 
"comparfe] said received at least all necessary information with a server-copy of the third tier 
certificate received from said third tier server system" or "accept[] said third tier server system as 
to be authenticated if said at least all necessary information matches said server-copy of the third 
tier certificate." The activities described with reference to Xiao, figure 2 are all happening on the 
client side. E.g., Xiao [0075]. 

Applicant's Background section also fails to teach or suggest these elements. In fact, 
Applicant's background section identifies as a drawback that "Each server application has a local 
certificate database which means additional effort to maintain and to protect the certificate data." 

Ramasubramani also fails to teach or suggest these elements. Instead, Ramasubramani is 
also merely directed to a two-tier system where the client and server can send each other their 
certificates. 

B. Claims 7. 12, and 16 

Claims 7, 12, and 16 contain limitations similar to those discussed with respect to claim 
1 . Therefore, for the reasons discussed above, Applicant respectfully submits that the proposed 
combinations also fail to teach or suggest these claim limitations. 
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C. Claims 2-6. 8-11. 13-15. and 17 

These claims are dependent on claims 1, 7, 12, or 16. Accordingly, the proposed 
combinations also fail to teach or suggest all elements of these claims. 

III. Conclusion 

In view of the above amendments and remarks, Applicant submits that this Application is 
in condition for allowance and respectfully request reconsideration and withdrawal of the 
rejections and objections. The Examiner is urged to call the undersigned at the below-listed 
telephone number if, in the Examiner's opinion, such a phone conference would expedite or aid 
in the prosecution of this Application. 



Respectfully submitted, 




Registration No. 42,696 



Telephone: (507) 253-4660 
Fax No.: (507) 253-2382 
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